PULSEUnderground Intel

EN VIVO18señales / 24h

FEED

ransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Servicesransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomn0n reclama a Company #103 · PT · Not Foundransomn0n reclama a Company #102 · Not Foundransomn0n reclama a Company #101 · Not Foundransomn0n reclama a Company #100 · Not Foundransomn0n reclama a Company #99 · Not Foundransomn0n reclama a TheHomeMag NorCal · US · Retail & E-Commerceransomclop reclama a LEGAL-RECORDS.US · US · Professional Services

← Todos los CVEs

CVE Watch16 oct 2026

CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application

CVSS

9.8

Crítico

EPSS

0.3%

p17

KEV

—

Exploit Today

5

0-100

Publicado: 16 oct 2026 · Última mod.: 16 oct 2026 · CWE-89

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-10-162026-10-20

Descripción técnica

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

Referencias oficiales

github.comhttps://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1140396.3 MED

——0A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.16h CVE-2026-1140847.7 ALT

——0Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.19h CVE-2026-1140817.7 ALT

——0Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.19h CVE-2026-1140656.5 MED

——0Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.19h CVE-2026-1137406.3 MED

——0A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.19h CVE-2015-201288.2 ALT

——0FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.23h